mirror of
https://github.com/amitwh/markdown-converter.git
synced 2026-08-02 18:10:18 +05:30
security: harden CSP, add path traversal protection, improve accessibility
Security fixes: - Remove external CDN sources from CSP (cdn.jsdelivr.net, cdnjs.cloudflare.com) - Add path validation functions to prevent path traversal attacks - Block access to sensitive system directories - Add isPathAccessible() check for file operations UI/Accessibility fixes: - Increase tab close button from 16px to 24px for better touch targets - Add focus-visible styles for keyboard navigation - Add ARIA labels to all toolbar buttons - Add aria-hidden="true" to decorative SVG icons - Add role="tablist" and role="tab" to tab bar - Fix duplicate font-size declaration in .preview-content Reports generated: - Security vulnerability scan (10 findings) - STRIDE threat model with MITRE ATT&CK mapping - Comprehensive UI design review (40 issues) Amit Haridas
This commit is contained in:
@@ -0,0 +1,215 @@
|
||||
# STRIDE Threat Model - MarkdownConverter v4.0.0
|
||||
|
||||
**Analysis Date:** 2026-03-15
|
||||
**Methodology:** STRIDE + MITRE ATT&CK
|
||||
**Overall Risk Score:** 7.8 (HIGH)
|
||||
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
The analysis identified **10 vulnerabilities** with a combined risk score of **7.8 (HIGH)**. The most critical issues enable complete system compromise through XSS-to-RCE attack chains.
|
||||
|
||||
---
|
||||
|
||||
## Critical Findings
|
||||
|
||||
| Priority | CVE | Vulnerability | CVSS | Impact |
|
||||
|----------|-----|---------------|------|--------|
|
||||
| P0 | CVE-MC-001 | Insecure Electron Config (`nodeIntegration: true`, `contextIsolation: false`) | 9.6 | Complete system compromise |
|
||||
| P0 | CVE-MC-002 | Arbitrary code execution via REPL feature | 9.3 | Remote code execution |
|
||||
| P1 | CVE-MC-003 | XSS in markdown rendering | 8.0 | Session hijacking, RCE chain |
|
||||
| P1 | CVE-MC-004 | Path traversal vulnerability | 7.8 | Arbitrary file write |
|
||||
| P1 | CVE-MC-005 | Weak Content Security Policy | 7.5 | XSS enablement |
|
||||
| P2 | CVE-MC-006 | Insecure window config for PDF export | 6.5 | Privilege escalation |
|
||||
| P2 | CVE-MC-007 | PlantUML server data exfiltration | 5.3 | Information disclosure |
|
||||
| P2 | CVE-MC-008 | Inconsistent security settings | 5.5 | Configuration weakness |
|
||||
| P3 | CVE-MC-009 | Command execution via external tools | 4.4 | Command injection risk |
|
||||
| P3 | CVE-MC-010 | Missing dependency version pinning | 3.5 | Supply chain risk |
|
||||
|
||||
---
|
||||
|
||||
## Key Attack Vectors
|
||||
|
||||
### 1. XSS to RCE Chain (Critical)
|
||||
```
|
||||
Malicious Markdown File
|
||||
│
|
||||
▼
|
||||
XSS in Preview (CVE-MC-003)
|
||||
│
|
||||
▼
|
||||
nodeIntegration: true (CVE-MC-001)
|
||||
│
|
||||
▼
|
||||
Full Node.js Access
|
||||
│
|
||||
▼
|
||||
Complete System Compromise
|
||||
```
|
||||
|
||||
### 2. REPL Code Execution (Critical)
|
||||
```
|
||||
Code Block in Markdown
|
||||
│
|
||||
▼
|
||||
User clicks "Run"
|
||||
│
|
||||
▼
|
||||
REPL executes Python/Bash (CVE-MC-002)
|
||||
│
|
||||
▼
|
||||
Arbitrary Code Execution
|
||||
```
|
||||
|
||||
### 3. Data Exfiltration (Medium)
|
||||
```
|
||||
PlantUML Diagram Content
|
||||
│
|
||||
▼
|
||||
Sent to www.plantuml.com (CVE-MC-007)
|
||||
│
|
||||
▼
|
||||
Sensitive Architecture Leaked
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## STRIDE Analysis
|
||||
|
||||
### S - Spoofing
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| S1 | Attacker spoofs markdown file origin | Medium | High | High |
|
||||
| S2 | Malicious code pretends to be safe | High | Critical | Critical |
|
||||
|
||||
### T - Tampering
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| T1 | XSS modifies local files | High | Critical | Critical |
|
||||
| T2 | Conversion output tampered | Medium | Medium | Medium |
|
||||
|
||||
### R - Repudiation
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| R1 | No audit trail for operations | Low | Low | Low |
|
||||
|
||||
### I - Information Disclosure
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| I1 | XSS exposes file system | High | Critical | Critical |
|
||||
| I2 | PlantUML content leaked | Medium | Medium | Medium |
|
||||
| I3 | Error messages reveal paths | Low | Low | Low |
|
||||
|
||||
### D - Denial of Service
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| D1 | Malicious code crashes app | Medium | Medium | Medium |
|
||||
| D2 | Large file exhausts resources | Low | Low | Low |
|
||||
|
||||
### E - Elevation of Privilege
|
||||
| ID | Threat | Likelihood | Impact | Risk |
|
||||
|----|--------|------------|--------|------|
|
||||
| E1 | XSS → nodeIntegration → System | High | Critical | Critical |
|
||||
| E2 | REPL code execution | High | Critical | Critical |
|
||||
|
||||
---
|
||||
|
||||
## MITRE ATT&CK Mapping
|
||||
|
||||
| Technique | ID | Applicability |
|
||||
|-----------|-----|---------------|
|
||||
| User Execution | T1204.002 | Malicious markdown file |
|
||||
| Command and Scripting Interpreter | T1059.007 | JavaScript via nodeIntegration |
|
||||
| Command and Scripting Interpreter | T1059.006 | Python via REPL |
|
||||
| Command and Scripting Interpreter | T1059.004 | Bash via REPL |
|
||||
| Exploit Public-Facing Application | T1190 | XSS in preview |
|
||||
| Data Exfiltration Over Web Service | T1043 | PlantUML server |
|
||||
| File and Directory Discovery | T1083 | Path traversal |
|
||||
|
||||
---
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ TRUST BOUNDARY MAP │
|
||||
├─────────────────────────────────────────────────────────────────────┤
|
||||
│ │
|
||||
│ ┌─────────────┐ ┌─────────────────────────────────────┐ │
|
||||
│ │ USER │ ──────► │ APPLICATION │ │
|
||||
│ │ (Untrusted) │ │ ┌───────────┐ ┌───────────────┐ │ │
|
||||
│ └─────────────┘ │ │ Renderer │ │ Main Process │ │ │
|
||||
│ │ │ (Sandbox) │ │ (Privileged) │ │ │
|
||||
│ │ └─────┬─────┘ └───────┬───────┘ │ │
|
||||
│ │ │ IPC │ │ │
|
||||
│ │ ▼ ▼ │ │
|
||||
│ │ ┌─────────────────────────────┐ │ │
|
||||
│ │ │ File System │ │ │
|
||||
│ │ └─────────────────────────────┘ │ │
|
||||
│ └─────────────────────────────────────┘ │
|
||||
│ │ │
|
||||
│ ▼ │
|
||||
│ ┌─────────────────────────────────────────────────────────────┐ │
|
||||
│ │ EXTERNAL SERVICES │ │
|
||||
│ │ • PlantUML Server (www.plantuml.com) │ │
|
||||
│ │ • CDN (cdn.jsdelivr.net, cdnjs.cloudflare.com) [REMOVED] │ │
|
||||
│ │ • External Tools (Pandoc, FFmpeg, LibreOffice) │ │
|
||||
│ └─────────────────────────────────────────────────────────────┘ │
|
||||
│ │
|
||||
└─────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Business Impact Analysis
|
||||
|
||||
### Successful Attack Consequences
|
||||
|
||||
| Impact Category | Estimate |
|
||||
|-----------------|----------|
|
||||
| Data breach costs | $500,000 - $5,000,000+ |
|
||||
| Regulatory fines (GDPR) | Up to 4% annual revenue |
|
||||
| Reputation damage | Incalculable |
|
||||
| Business disruption | Hours to days |
|
||||
|
||||
### Affected Assets
|
||||
- User documents and files
|
||||
- System credentials
|
||||
- Proprietary information in diagrams
|
||||
- Application integrity
|
||||
|
||||
---
|
||||
|
||||
## Remediation Priority
|
||||
|
||||
### P0 - Immediate (24-48 hours)
|
||||
1. **CVE-MC-001**: Set `nodeIntegration: false`, `contextIsolation: true`
|
||||
2. **CVE-MC-002**: Remove or sandbox REPL code execution
|
||||
|
||||
### P1 - Short-term (1-2 weeks)
|
||||
3. **CVE-MC-003**: Audit markdown extensions for XSS
|
||||
4. **CVE-MC-004**: Add path validation (✅ COMPLETED)
|
||||
5. **CVE-MC-005**: Strengthen CSP (✅ COMPLETED)
|
||||
|
||||
### P2 - Medium-term (1 month)
|
||||
6. **CVE-MC-006**: Consistent window security settings
|
||||
7. **CVE-MC-007**: Add local PlantUML option or warning
|
||||
8. **CVE-MC-008**: Audit all BrowserWindow configurations
|
||||
|
||||
### P3 - Long-term
|
||||
9. **CVE-MC-009**: Validate filenames for external tools
|
||||
10. **CVE-MC-010**: Pin dependency versions, add scanning
|
||||
|
||||
---
|
||||
|
||||
## Conclusion
|
||||
|
||||
The MarkdownConverter application has a **HIGH RISK** threat profile due to the combination of:
|
||||
- Untrusted content rendering (markdown preview)
|
||||
- Direct system access (nodeIntegration)
|
||||
- Code execution capability (REPL)
|
||||
|
||||
**Immediate action required on P0 items to reduce attack surface.**
|
||||
|
||||
The fixes applied in this session (CSP, path traversal, UI accessibility) have reduced the risk profile, but the critical nodeIntegration issue requires significant refactoring.
|
||||
Reference in New Issue
Block a user